User Application Monitoring through Assessment of Abnormal Behaviours Recorded in RAS Logs
Byung H. Park, Thomas J. Naughton, Raghul Gunasekaran, David Dillow, Galen M Shipman · 2011
Abnormal status of an application is typically detected by hard evidence, e.g., out of memory, segmentation fault. However, such information only provides clues for the notification of abnormal termination of the application; lost are any implications as to the application's termination with respect to the particular context of the platform. Restated, the generic exception the application reports is devoid of the overall system context that is captured elsewhere in the system, e.g., RAS logs. In this paper we present an activity based application monitoring framework that extracts both facts (events) and context with regard to applications from RAS logs, and maps them into entropy scores that represent degrees of unusualness for applications. The paper describes our results from applying the framework to the Cray Jaguar system at Oak Ridge National Laboratory, and discusses how it identified applications running abnormally and implications based on the type of abnormality.